部署etcd集群
Posted kevin_ying
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了部署etcd集群相关的知识，希望对你有一定的参考价值。
1、集群规划
| 服务器名称 | 服务地址 | 角色 |
|---|---|---|
| YN101-22.host.com | 192.168.101.22 | etcd leader |
| YN101-31.host.com | 192.168.101.31 | etcd follow |
| YN101-32.host.com | 192.168.101.32 | etcd follow |
2、创建基于根证书的config配置文件YN101-100.host.com主机操作
cd /opt/certs/
vi ca-config.json{
"signing": {
"default": {
"expiry": "175200h"
},
"profiles": {
"server": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"server auth"
]
},
"client": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"server auth"
]
},
"peer": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"server auth"
]
}
}
}
}vi etcd-peer-csr.json
{
"CN": "k8s-etcd",
"hosts": [
"192.168.101.21",
"192.168.101.22",
"192.168.101.31",
"192.168.101.32"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "YN",
"L": "KM",
"O": "kevin",
"OU": "edu"
}
]
}
#生成etcd证书和私钥
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer etcd-peer-csr.json |cfssl-json -bare etcd-peer
#生成证书如下
[root@yn101-100 certs]# ll
total 36
-rw-r--r-- 1 root root 610 Feb 17 22:54 ca-config.json
-rw-r--r-- 1 root root 985 Feb 16 12:53 ca.csr
-rw-r--r-- 1 root root 189 Feb 16 12:53 ca-csr.json
-rw------- 1 root root 1679 Feb 16 12:53 ca-key.pem
-rw-r--r-- 1 root root 1322 Feb 16 12:53 ca.pem
-rw-r--r-- 1 root root 1054 Feb 17 22:56 etcd-peer.csr
-rw-r--r-- 1 root root 300 Feb 17 22:37 etcd-peer-csr.json
-rw------- 1 root root 1679 Feb 17 22:56 etcd-peer-key.pem
-rw-r--r-- 1 root root 1395 Feb 17 22:56 etcd-peer.pem3、YN101-22.host.com主机操作
给etcd创建一个用户
useradd -s /sbin/nologin -M etcd
[root@yn101-22 src]# id etcd
uid=1000(etcd) gid=1000(etcd) groups=1000(etcd)#etcd下载地址，本机安装3.1.20版本
https://github.com/etcd-io/etcd/releases/tag/v3.1.20#解压
cd /opt/src
tar xfv etcd-v3.1.20-linux-amd64.tar.gz -C /opt/
mv etcd-v3.1.20-linux-amd64/ etcd-v3.1.20
#软连接
[root@yn101-22 opt]# ln -s /opt/etcd-v3.1.20/ /opt/etcd
[root@yn101-22 opt]# ll
total 0
lrwxrwxrwx 1 root root 18 Feb 17 23:05 etcd -> /opt/etcd-v3.1.20/
drwxr-xr-x 3 478493 89939 123 Oct 11 2018 etcd-v3.1.20
drwxr-xr-x 2 root root 45 Feb 17 22:19 src#创建目录，拷贝证书和私钥
mkdir -p /opt/etcd/certs /data/etcd /data/logs/etcd-server
scp yn101-100:/opt/certs/ca.pem .
scp yn101-100:/opt/certs/etcd-peer.pem .
scp yn101-100:/opt/certs/etcd-peer-key.pem .创建etcd的启动脚本 vi /opt/etcd/etcd-server-startup.sh
#!/bin/sh
./etcd --name etcd-server-101-22 --data-dir /data/etcd/etcd-server --listen-peer-urls https://192.168.101.22:2380 --listen-client-urls https://192.168.101.22:2379,http://127.0.0.1:2379 --quota-backend-bytes 8000000000 --initial-advertise-peer-urls https://192.168.101.22:2380 --advertise-client-urls https://192.168.101.22:2379,http://127.0.0.1:2379 --initial-cluster etcd-server-101-22=https://192.168.101.22:2380,etcd-server-101-31=https://192.168.101.31:2380,etcd-server-101-32=https://192.168.101.32:2380 --ca-file ./certs/ca.pem --cert-file ./certs/etcd-peer.pem --key-file ./certs/etcd-peer-key.pem --client-cert-auth --trusted-ca-file ./certs/ca.pem --peer-ca-file ./certs/ca.pem --peer-cert-file ./certs/etcd-peer.pem --peer-key-file ./certs/etcd-peer-key.pem --peer-client-cert-auth --peer-trusted-ca-file ./certs/ca.pem --log-output stdoutchmod +x etcd-server-startup.sh
chown -R etcd.etcd /opt/etcd-v3.1.20/
#更改后输出如下，文件为etcd用户
[root@yn101-22 etcd]# ll
total 30072
drwxr-xr-x 2 etcd etcd 66 Feb 17 23:12 certs
drwxr-xr-x 11 etcd etcd 4096 Oct 11 2018 Documentation
-rwxr-xr-x 1 etcd etcd 16406432 Oct 11 2018 etcd
-rwxr-xr-x 1 etcd etcd 14327712 Oct 11 2018 etcdctl
-rwxr-xr-x 1 etcd etcd 876 Feb 17 23:30 etcd-server-startup.sh
-rw-r--r-- 1 etcd etcd 32632 Oct 11 2018 README-etcdctl.md
-rw-r--r-- 1 etcd etcd 5878 Oct 11 2018 README.md
-rw-r--r-- 1 etcd etcd 7892 Oct 11 2018 READMEv2-etcdctl.md
[root@yn101-22 etcd]# chown -R etcd.etcd /data/etcd/
[root@yn101-22 etcd]# chown -R etcd.etcd /data/logs/etcd-server/#安装管理后台进程软件，etcd后台启动如果进程掉了会自动启动
yum install supervisor -y
[root@yn101-22 etcd]# systemctl start supervisord
[root@yn101-22 etcd]# systemctl enable supervisord
Created symlink from /etc/systemd/system/multi-user.target.wants/supervisord.service to /usr/lib/systemd/system/supervisord.service.#创建supervisor的启动文件
vi /etc/supervisord.d/etcd-server.ini
#内容如下
[program:etcd-server-101-22]
command=/opt/etcd/etcd-server-startup.sh
numprocs=1
directory=/opt/etcd
autostart=true
autorestart=true
startsecs=30
startretries=3
exitcodes=0,2
stopsignal=QUIT
stopwaitsecs=10
user=etcd
redirect_stderr=true
stdout_logfile=/data/logs/etcd-server/etcd.stdout.log
stdout_logfile_maxbytes=64MB
stdout_logfile_backups=4
stdout_capture_maxbytes=1MB
stdout_events_enabled=false[root@yn101-22 etcd]# supervisorctl update
etcd-server-101-22: added process group
#查看启动状态
[root@yn101-22 etcd]# supervisorctl status
etcd-server-101-22 RUNNING pid 11849, uptime 0:01:31
#查看启动日志
tail -fn 200 /data/logs/etcd-server/etcd.stdout.log
#为running状态，监听2379和2380端口才算启动成功
[root@yn101-22 etcd]# netstat -luntp | grep etcd
tcp 0 0 192.168.101.22:2379 0.0.0.0:* LISTEN 11850/./etcd
tcp 0 0 127.0.0.1:2379 0.0.0.0:* LISTEN 11850/./etcd
tcp 0 0 192.168.101.22:2380 0.0.0.0:* LISTEN 11850/./etcd 4、YN101-31.host.com安装etcd
cd /opt/src
tar xfv etcd-v3.1.20-linux-amd64.tar.gz -C /opt/
mv etcd-v3.1.20-linux-amd64/ etcd-v3.1.20
#软连接
ln -s /opt/etcd-v3.1.20/ /opt/etcd
#创建一个etcd的用户
useradd -s /sbin/nologin -M etcd
#创建目录，拷贝证书和私钥
mkdir -p /opt/etcd/certs /data/etcd /data/logs/etcd-server
scp yn101-100:/opt/certs/ca.pem .
scp yn101-100:/opt/certs/etcd-peer.pem .
scp yn101-100:/opt/certs/etcd-peer-key.pem .创建etcd的启动脚本 vi /opt/etcd/etcd-server-startup.sh
#!/bin/sh
./etcd --name etcd-server-101-32 --data-dir /data/etcd/etcd-server --listen-peer-urls https://192.168.101.32:2380 --listen-client-urls https://192.168.101.32:2379,http://127.0.0.1:2379 --quota-backend-bytes 8000000000 --initial-advertise-peer-urls https://192.168.101.32:2380 --advertise-client-urls https://192.168.101.32:2379,http://127.0.0.1:2379 --initial-cluster etcd-server-101-22=https://192.168.101.22:2380,etcd-server-101-31=https://192.168.101.31:2380,etcd-server-101-32=https://192.168.101.32:2380 --ca-file ./certs/ca.pem --cert-file ./certs/etcd-peer.pem --key-file ./certs/etcd-peer-key.pem --client-cert-auth --trusted-ca-file ./certs/ca.pem --peer-ca-file ./certs/ca.pem --peer-cert-file ./certs/etcd-peer.pem --peer-key-file ./certs/etcd-peer-key.pem --peer-client-cert-auth --peer-trusted-ca-file ./certs/ca.pem --log-output stdoutchmod +x etcd-server-startup.sh
#更改文件为etcd用户权限
chown -R etcd.etcd /opt/etcd-v3.1.20/
chown -R etcd.etcd /data/etcd/
chown -R etcd.etcd /data/logs/etcd-server/#安装管理后台进程软件，etcd后台启动如果进程掉了会自动启动
yum install supervisor -y
[root@yn101-22 etcd]# systemctl start supervisord
[root@yn101-22 etcd]# systemctl enable supervisord
Created symlink from /etc/systemd/system/multi-user.target.wants/supervisord.service to /usr/lib/systemd/system/supervisord.service.#创建supervisor的启动文件
vi /etc/supervisord.d/etcd-server.ini
#内容如下
[program:etcd-server-101-32]
command=/opt/etcd/etcd-server-startup.sh
numprocs=1
directory=/opt/etcd
autostart=true
autorestart=true
startsecs=30
startretries=3
exitcodes=0,2
stopsignal=QUIT
stopwaitsecs=10
user=etcd
redirect_stderr=true
stdout_logfile=/data/logs/etcd-server/etcd.stdout.log
stdout_logfile_maxbytes=64MB
stdout_logfile_backups=4
stdout_capture_maxbytes=1MB
stdout_events_enabled=false[root@yn101-22 etcd]# supervisorctl update
etcd-server-101-22: added process group
#查看启动状态
[root@yn101-22 etcd]# supervisorctl status
etcd-server-101-22 RUNNING pid 11849, uptime 0:01:31
#查看启动日志
tail -fn 200 /data/logs/etcd-server/etcd.stdout.log
#为running状态，监听2379和2380端口才算启动成功
[root@yn101-22 etcd]# netstat -luntp | grep etcd
tcp 0 0 192.168.101.22:2379 0.0.0.0:* LISTEN 11850/./etcd
tcp 0 0 127.0.0.1:2379 0.0.0.0:* LISTEN 11850/./etcd
tcp 0 0 192.168.101.22:2380 0.0.0.0:* LISTEN 11850/./etcd #全部状态为running时，可在任意节点查看etcd健康状态
[root@yn101-22 etcd]# supervisorctl status
etcd-server-101-22 RUNNING pid 11849, uptime 0:01:31
#健康状态监测
cd /opt/etcd
./etcdctl cluster-health以上是关于部署etcd集群的主要内容，如果未能解决你的问题，请参考以下文章